CVE-2019-1653
Scores
EPSS Score
0.9437
CVSS
3.x 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
All CVSS Scores
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Description
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.
Sources
CWEs
Related Vulnerabilities
Exploits
Exploit ID: CVE-2019-1653
Source: github-poc
URL: https://github.com/elzerjp/nuclei-CiscoRV320Dump-CVE-2019-1653
Reference Links
Vulnerable Software
Type: Configuration
Vendor: cisco
Product: rv320_firmware
Operating System: * * *
{
"children": [
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:o:cisco:rv320_firmware:1.4.2.15:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:o:cisco:rv320_firmware:1.4.2.17:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
},
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:h:cisco:rv320:-:*:*:*:*:*:*:*"
}
],
"operator": "OR"
}
],
"operator": "AND"
}Source: nvd
Type: Configuration
Vendor: cisco
Product: rv325_firmware
Operating System: * * *
{
"children": [
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:o:cisco:rv325_firmware:1.4.2.15:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:o:cisco:rv325_firmware:1.4.2.17:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
},
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:h:cisco:rv325:-:*:*:*:*:*:*:*"
}
],
"operator": "OR"
}
],
"operator": "AND"
}Source: nvd